Across the world, governments are grappling with the same question: how do you protect children in a digital environment that was largely built without them in mind? From Australia’s Social Media Minimum Age legislation banning children under 16 from social media platforms, to the United Kingdom’s Online Safety Act, to the European Union’s enforcement actions under the Digital Services Act targeting platform design practices harmful to minors – the regulatory direction is consistent. Digital platforms, and social media in particular, are facing unprecedented legislative scrutiny over the risks they pose to children, and governments are stepping in where market self-regulation has fallen short.
The UAE is no exception – and its response is among the most structured to date.
With the enactment of a dedicated child digital safety framework, the UAE introduced two interlocking instruments that together set hard rules for how digital platforms operate and what parents (and guardians) must do to follow the new rules:
- Federal Decree-Law No. 26 of 2025 on Child Digital Safety (the “Law”), which entered into force on 1 January 2026. It applies broadly across all digital platforms operating within the UAE or directed at users therein (ex: websites, search engines, messaging apps, gaming platforms, social media, etc.).
- Cabinet Resolution No. 106 of 2026 on the Regulation of Children’s Access to Social Media Platforms (the “Resolution”), which entered into force on 30 June 2026, translating the Law’s broader framework into specific, operational rules targeting social media in particular.
Together, they form an interlocking regime. The Law is the parent framework; the Resolution is the operational rulebook. Their objectives are unified in relation to children’s protection from digital risks and harmful content, promote awareness of digital rights and responsibilities among children and caregivers, and establish a governance framework that defines the roles and responsibilities of the relevant authorities in securing the digital environment for children.
The New Rules: What the Framework Requires
Both, the Law and Resolution, introduce different rules that digital platforms (individuals and/or entities operating them) and parents (or caregivers, as often referred to in the Resolution) must abide. We will highlight the most impactful rules introduced by the framework – those most likely to require immediate action or structural change for businesses operating in or directed at the UAE:
Rules impacting all digital platforms
- Platforms must deploy parental control tools and make them accessible to caregivers.
- Personal data of children under 13 may not be collected, processed, or shared without explicit and verifiable parental consent, and may not be used for commercial or advertising purposes under any circumstances.
- Platforms must provide accessible reporting tools for harmful content and immediately notify the relevant authorities upon detecting child pornographic or harmful material.
Rules impacting social media platforms (and caregivers)
- Hard minimum age of 15: children below that age may not hold an account. No exceptions, and parental consent does not override this prohibition.
- Children aged 15 and 16 must be placed on a mandatory restricted mode, with content filtering, limited sharing, capped usage periods, disabled live streaming, and dampened algorithmic recommendations active by default.
- Self-declaration of age is prohibited. Platforms must implement approved age verification only: government ID verification, biometric document scanning, AI-based age estimation, or a licensed verification provider.
- Behavioural advertising directed at children is prohibited. Any ad mechanism that relies on tracking or profiling a child’s digital activity must be switched off.
- Platforms must continuously detect and immediately remove underage accounts – verification at sign-up alone is not sufficient.
- Default settings must always be the most protective available. Safety is not opt-in.
What This Means in Practice
The practical implications of this framework differ significantly depending on whether you are a platform operator or a caregiver. Below is what each is expected to do.
Digital platforms
- Implement approved age verification mechanisms – self-declaration is not permitted and must be replaced with government ID verification, biometric document scanning, AI-based age estimation, or a licensed verification provider.
- Block account creation entirely for users under 15, with no exceptions and no override by parental consent.
- Activate a mandatory restricted mode for users aged 15 and 16, with protective settings enabled by default.
- Switch off behavioural advertising and any ad-targeting mechanism that relies on tracking or profiling a child’s digital activity.
- Continuously monitor for and remove underage accounts – sign-up verification alone does not satisfy the obligation.
- Conduct periodic digital safety risk assessments and report to the relevant authorities on compliance measures taken.
Caregivers
- Do not create or enable a social media account for a child under 15, and do not assist a child in bypassing age verification.
- Actively use the parental control tools that platforms are now legally required to provide, particularly for children aged 15 and 16.
- Monitor the digital activity of children in your care and take steps to prevent exposure to harmful content.
- Report any harmful content encountered by a child in your care to the relevant authorities – platform reporting tools are the first point of contact for general harmful content; the Ministry of Interior’s cybercrime channels are available for serious or criminal material.
How Are Rules Enforced
The enforcement regime is currently more developed on the platform side. The National Media Authority and the Telecommunications and Digital Government Regulatory Authority jointly oversee compliance and may issue warnings, impose partial or total blocking, or apply administrative penalties against non-compliant platforms.
For caregivers, the obligation is equally live – but the specific penalty schedule has not yet been issued. The Cabinet is empowered to publish it, and it is forthcoming. Caregivers who actively circumvent age verification mechanisms – particularly by providing false documents – may in the interim engage existing cybercrime legislation independently of this framework.
The broader message is deliberate: caregivers are expected to be active participants in securing their child’s digital environment. Platform controls, however robust, cannot fully substitute for informed and engaged parental oversight, and the law makes that expectation enforceable.
Conclusion
The UAE has moved from aspiration to obligation. Child digital safety is now a regulated, enforceable legal requirement – with defined rules for platforms and caregivers alike. Businesses and families alike should treat compliance not as a box-ticking exercise, but as the baseline from which responsible digital engagement now begins.
